Build trust with CSA STAR in 2025

The Cloud Security Alliance (CSA) is a nonprofit organisation. It's dedicated to defining best practices to help ensure a more secure cloud computing environment. Security, Trust, Assurance and Risk (STAR) was launched as a publicly accessible registry in which cloud service providers (CSPs) can publish their CSA-related assessments.

Level 1: Self-Assessment based on the Consensus Assessments Initiative Questionnaire (CAIQ). The CAIQ contains more than 250 questions based on the cloud controls matric (CCM) that a customer or cloud auditor may want to ask of CSPs to assess their compliance with CSA best practices.

Level 2: Independent third-party assessments such as CSA STAR Attestation and CSA STAR Certification. These assessments combine established industry standards with criteria specified in the CCM. The CCM covers 17 domains and 197 control objectives related to best practice cloud security.

Level One accreditation is based on completing questionnaires to provide information that may or may not have been independently verified into the online CSA register for third-party review. 

Level Two is a certification or attestation report that has been independently audited and submitted to the CSA. 

Level Three is a level of continuous assurance for the higher standard of cloud security and third-party assurance.

Yes, but you can do both together. Level One is a completed questionnaire that’s submitted to the CSA registry covering the same details as what’s audited for Level Two accreditation covering the cloud controls matrix. 

Yes. You either need to show how your cloud security practices meet each of the 197 objectives or substantiate why they are not applicable. The number of objectives sounds daunting but there is a lot of overlap in the controls that cover each. We see clients have an average of 220 controls to satisfy the 197 objectives. 

A Type 1 report attests to your compliance by design. It’s a snapshot in time that can be achieved by showing you have the right systems and processes in place to satisfy the CSA STAR regulatory clauses.

A Type 2 report attests to your compliance by both design and operation over a period of time. It covers a period between 3-12 months to show your systems and processes have been operated consistently to satisfy the CSA STAR regulatory clauses.

Usually, a Type 1 report is issued first to baseline compliance. That marks the start of the live and recurring Type 2 audit periods for reports issued annually.

No. CSA STAR is designed to be complementary. Level Two accreditation offers pathways through SOC 2 or ISO 27001 so that you can leverage all your compliance efforts on those more common standards. CSA STAR can be built on top of either SOC 2 or ISO 270001 following a certification or attestation report approach so that it is compatible with those two global leading standards and the associated audit firm and/or certification body credentials that accredit those standards.